T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_obdcode.py:72- Finding
API Credential Transmitted in the URL Query String
- Content
View full analysis
- Remediation
View remediation
Security audit
Tianapi Obdcode - 汽车OBD查询
Security checks for vulnerabilities and agentic risk
Overview
This OBD lookup skill appears purpose-aligned, but it has material credential-handling weaknesses and a broken executable script that users should review before installing.
Review before installing. Prefer setting TIANAPI_OBDCODE_KEY as an environment variable, avoid passing the key on the command line, do not create scripts/.env unless it is owner-readable and excluded from version control, and rotate the key if it appears in shell history or logs. This version also needs a code fix before the bundled script will run.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_obdcode.py:111- Finding
API Key Accepted Through Process Arguments and Potentially Permissive Credential File
- Content
View full analysis
scripts/.env ``` ### Technical Analysis Command-line arguments are an unsuitable channel for long-lived secrets. Depending on the operating system and process-isolation configuration, process arguments may be visible to other local processes or users through process inspection interfaces. Commands may also be retained in shell history, terminal logs, automation output, or support transcripts. The `.env` alternative stores the API key as plaintext. The documented creation command relies on the user's current `umask` and does not ensure that only the owner can read the file. On systems with permissive defaults, another local account or service may be able to read the credential. The environment-variable method is described as preferred and is safer than placing the key in command history, although environment variables can still be exposed to sufficiently privileged or same-context processes. A protected credential store or owner-readable configuration file would provide stronger handling. ### Attack Path #### Command-line exposure 1. A user invokes the script with `--key YOUR_API_KEY`. 2. The complete command is retained in shell history or exposed throu ...[truncated 1047 chars]- Remediation
View remediation
scripts/.env chmod 600 scripts/.env ``` 5. Verify file ownership and permissions before reading the credential. 6. Ensure `.env` is excluded from version control, archives, diagnostic bundles, and published Skill packages. 7. Warn users not to paste secrets into command histories, issue trackers, or terminal transcripts. 8. Rotate any key that may already have appeared in shell history or a broadly readable file. ]]>
other
Warning
- Location
scripts/fetch_obdcode.py:57- Finding
Invalid Markup Embedded in Python Source Prevents Skill Execution
- Content
View full analysis
source_group_web_1 ``` ### Technical Analysis The line contains non-Python markup appended directly after a string literal. Python cannot parse this expression, so the interpreter raises a syntax error while loading the file. Because parsing occurs before `main()` executes, every invocation fails before configuration loading, argument validation, or the TianAPI request. This appears to be accidental artifact contamination rather than intentionally embedded executable code. The markup does not itself create a code-execution path. The defect demonstrates that the distributed script was not subjected to a basic syntax or execution check before release. ### Attack Path No external exploitation prerequisite is necessary: 1. A user or Agent invokes `scripts/fetch_obdcode.py`. 2. Python parses the source file. 3. Parsing reaches the invalid markup on line 57. 4. Python terminates with a syntax error. 5. The OBD-code lookup does not occur. There is no demonstrated path from this defect to arbitrary code execution, credential theft, or privilege escalation. ### Impact Assessment The impact is complete loss of availability for the declared Skill functionality. All script invocations fail, regardless of the supplied API key or OBD code. The issue does not grant an attacker additional privileges and does not expose data by itself. Its scope is limited to preventing this Skill from operating, although repeated Agent attempts could waste execution time and produce confusing failures. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
This finding reflects credential handling guidance that places a live API key into a local .env file. While the skill is not directly stealing credentials, it encourages a pattern that materially increases the chance of credential disclosure and subsequent unauthorized API use, billing abuse, or account misuse.
- Content
md # 方式一：环境变量（推荐，一次配置永久生效） export TIANAPI_OBDCODE_KEY=你的APIKey # 方式二：.env 文件（在脚本目录创建） echo "TIANAPI_OBDCODE_KEY=你的APIKey" > scripts/.env # 方式三：每次命令行传入
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The documentation immediately follows the .env example with a command-line example using the API key directly, reinforcing insecure secret exposure paths. In context, this is more dangerous because the skill is specifically designed to consume an external secret and provides multiple unsafe ways to surface that secret during normal use.
- Content
md export TIANAPI_OBDCODE_KEY=你的APIKey # 方式二：.env 文件（在脚本目录创建） echo "TIANAPI_OBDCODE_KEY=你的APIKey" > scripts/.env # 方式三：每次命令行传入 python3 scripts/fetch_obdcode.py --key 你的APIKey --code P267B
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Env Config: export TIANAPI_OBDCODE_KEY=your_api_key # 或在脚本同级目录创建 .env 文件: TIANAPI_OBDCODE_KEY=your_api_key """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Env Config: export TIANAPI_OBDCODE_KEY=your_api_key # 或在脚本同级目录创建 .env 文件: TIANAPI_OBDCODE_KEY=your_api_key """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Env Config: export TIANAPI_OBDCODE_KEY=your_api_key # 或在脚本同级目录创建 .env 文件: TIANAPI_OBDCODE_KEY=your_api_key """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Env Config: export TIANAPI_OBDCODE_KEY=your_api_key # 或在脚本同级目录创建 .env 文件: TIANAPI_OBDCODE_KEY=your_api_key """ import os
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python return env_val # 2. .env 文件 env_file = Path(__file__).parent / ".env" if env_file.exists(): try: content = env_file.read_text(encoding="utf-8")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents use of environment variables, local files, and outbound network/API access, but it does not declare any explicit tool scope or allowed-tools/permissions. This weakens least-privilege controls because an agent or platform may permit broader capability use than readers expect, increasing the chance of unintended file access, secret handling, or network exfiltration if the skill is invoked automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation instructs users to write the API key into scripts/.env in plaintext without any warning about file permissions, git exclusion, or secret management. Plaintext credential storage is dangerous because the key can be accidentally committed, read by other local users/processes, or exposed through backups and logs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The examples show passing the API key on the command line and in a URL query string, both of which can leak secrets through shell history, process listings, terminal logs, proxies, browser history, or HTTP server/access logs. Even if intended as convenience documentation, this trains users into insecure secret-handling patterns.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The .env parsing implementation is broken: line.split("=", 1) returns a list, so calling .strip() on it raises an exception that is silently swallowed. This can cause operators to believe secrets are loaded from .env when they are not, leading to misconfiguration and accidental fallback to less safe key handling such as passing secrets on the command line.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code file performs an outbound HTTP request and includes the API key in the request parameters, but the script provides no user-facing warning beyond basic usage text that the credential will be sent to TianAPI. Under the code-file criteria, network transmission of user or system data should have some disclosure unless clearly warned or documented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The natural-language instructions and descriptions in the module docstring are predominantly Chinese, and the file does not indicate that this language restriction is intentional or offer any user language choice. The policy requires avoiding forced language/locale constraints unless the constraint is explicit and justified.
- Content
Static analysis
No suspicious patterns detected.